Wynko.
NL
Get the plugin

Privacy

What Wynko sends to Laposta

Wynko talks to one external service and one only: the Laposta API at https://api.laposta.nl. This page lists exactly what leaves your site for it, so you can describe it accurately in your own privacy policy.

When a visitor submits a signup form

The submission is sent to Laposta’s subscriber endpoint so the person can be added to the list. It contains:

  • The email address the visitor entered.
  • The other field values the visitor entered. Which fields these are is not fixed — they’re whatever the bound Laposta list defines (a name, a date of birth, a choice from a list, and so on). Wynko sends the values as typed; it doesn’t add fields of its own.
  • The visitor’s IP address. Laposta requires it — it’s part of how double opt-in and abuse handling work on their side. Wynko takes it only from the direct connection to your server, never from a X-Forwarded-For or similar proxy header, and sends it empty rather than send something that isn’t a valid IP address.
  • The address of the page the form was on — the path and any query string, for example /newsletter/?ref=footer. This comes from a hidden field WordPress puts in the form, not from your browser’s Referer header, and it’s the site-relative path only. It’s omitted if it isn’t available.

That’s it. No cookies, no tracking or advertising identifiers, no browser fingerprint, nothing about other pages the visitor viewed. Nothing is sent unless a visitor actually submits a form — loading a page that merely contains one contacts nobody.

Wynko does not keep the submission on your own site: there’s no database row, no queue, no local copy of what was typed. The activity log records only which form was submitted and whether it succeeded — never the email address or any field value.

If your site adds to the payload

A developer filter (wynko_subscriber_data, see Hooks and filters) lets code on your own site add or change fields in the request before it goes to Laposta. Nothing in Wynko uses it out of the box — but if you’ve added code that does, that code is sending whatever it adds, and your privacy policy should account for it.

Signups through an integration

The bundled Contact Form 7 and HTML Forms integrations send the same core data — the email address, the mapped field values, and the visitor’s IP address as that form plugin resolved it.

The other times Wynko contacts Laposta

  • When you save or verify your API key, the key is sent so Laposta can confirm it works before Wynko stores it.
  • When the campaigns block’s data is fetched or refreshed, Wynko asks Laposta for your recently sent campaigns. Nothing about any visitor is sent — this is your account’s own data.

Wynko’s server-side code makes no request to any host other than Laposta’s.

Laposta’s own terms

Laposta is the data processor for everything above once it arrives. Their published policies: